Methods for monitoring electronic control systems, based on the fact that a checksum is cyclically calculated over the entire code region or a portion thereof, are conventional. These are intended to detect when the code has been modified, whether by tuning or by charge loss in the memory element. The checksum calculation for manipulation or data loss should be carried out at startup of the system in order to achieve the greatest possible reliability. This is not feasible, however, because of the long times resulting from a complete checksum calculation over code from 100 KB to several megabytes, since the starting behavior of the system would thereby be slowed down and the customer would perceive this as a drawback.
In a context of ongoing instruction accesses (i.e., during operation), a method expressed by hardware is known for preventing data loss with regard to the problem of charge loss of flash memory elements. In this method with the corresponding hardware, also called error check and correction (ECC), not only are memory cells present that are necessary for the storage of information, i.e., for control commands and/or data (the actual code), but a number of memory cells having an additional datum, with which a determination can be made as to whether the information in the cells for information storage has changed, are additionally present. This is implemented in hardware in a context of ongoing instruction access, i.e., during operation. Hardware of this kind is described, for example, in German Patent No. DE 38 33 713 A1. As the name itself suggests, these additional data in some cases also make possible a correction of corrupt data. With the aforesaid method, however, the corresponding data are checked during ongoing operation, i.e., in a context of ongoing instruction accesses, so that those parts of the data or of the memory that are addressed less frequently or not at all by ongoing instruction accesses are checked less frequently or not at all. In the context of the aforesaid German Patent, the conventional method therefore does not guarantee regular monitoring or checking of all the memory cells of a memory.
Also known is a property of modern flash memories called “margin read.” This function, described in German Patent Application No. DE 199 64 012 A1, ascertains whether the information in the memory cells is still sufficient even in normal mode (i.e., in normal operation) to permit error-free functioning of the control system. For that purpose, the memory cells are read out (or the cell current is measured) not at the normal bit line load but at an elevated load. If the cell charge is still sufficient, the information is read out correctly. If not, incorrect information is read out. By reading the information again without applying the elevated load and comparing the read-out values, it is possible to ascertain whether the charge is still sufficient. Reading of the information is always associated here with a checksum calculation, both for reading with margin read and for reading without margin read. If the checksums of the two operations are identical, it can be assumed that sufficient charge from the memory cells is present. This means, however, that here again a time-consuming checksum calculation must be carried out as already indicated above, with the aforementioned disadvantages.